Home / Tools / Lamport signature demo
Free tool · runs in your browser
Lamport signature demo: sign and forge with real SHA-256
A Lamport signature is the simplest quantum-resistant signature: it needs nothing but a hash function. Your key is 256 pairs of secrets, and signing reveals one secret from each pair. Sign once and it’s secure. Sign again with the same key and an attacker can start forging.
Built by Kyeson Blake Utley for the free Quantum Defense course.
How a Lamport signature works
- Key generation. Pick 256 pairs of random 32-byte secrets. The public key is the SHA-256 hash of each one.
- Signing. Hash the message to 256 bits. For each bit, reveal one secret from that position’s pair: the first if the bit is 0, the second if it’s 1.
- Verifying. Hash the message again, hash each revealed secret, and check it against the matching public hash.
Forging a signature on a new message needs at least one secret that was never revealed, which means inverting SHA-256. Against a hash function the best known quantum attack is Grover’s algorithm, a generic speedup with nothing like the effect Shor’s algorithm has on RSA and elliptic curves. Leslie Lamport described the scheme in 1979.
Why one time only
Each signature reveals half the secrets. A second signature on a different message reveals more, and soon an attacker holds both secrets for many bit positions and can search for a message whose digest needs only revealed secrets. The demo above runs that search for real. That one-time limit is why practical hash-based schemes combine many one-time keys: LMS and XMSS (NIST SP 800-208) with a Merkle tree and careful state tracking, and SLH-DSA (FIPS 205) without state at all.
This tool comes from Lesson 15: Lamport signatures: hash-based signing from scratch, part of a free 18-lesson post-quantum cryptography course. Every figure there links to its source.
Questions
Are Lamport signatures quantum-safe?
They rely only on the hash function being hard to invert, and no known quantum algorithm breaks that efficiently. Grover's algorithm gives only a generic speedup, which a 256-bit hash comfortably absorbs.
How big is a Lamport signature?
With SHA-256, the public key is 16,384 bytes (512 hashes of 32 bytes) and each signature is 8,192 bytes (256 secrets of 32 bytes), and each key should sign only one message.
Why can a Lamport key only be used once?
Every signature reveals half of the private secrets. Signing a second, different message reveals more, letting an attacker combine revealed secrets to forge signatures on new messages.
What replaced Lamport signatures in practice?
Schemes built on the same idea: Winternitz one-time signatures shrink them, Merkle trees combine many one-time keys under one public key (LMS, XMSS), and SLH-DSA (FIPS 205) removes the need to track state.